1 files changed, 16 insertions, 0 deletions
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/1600635.html b/testing/web-platform/tests/mathml/crashtests/mozilla/1600635.html
new file mode 100644
index 0000000000..d6ad315885
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/1600635.html
@@ -0,0 +1,16 @@
+<style>
+  * {
+    overflow-inline: scroll;
+  }
+</style>
+<script>
+  window.addEventListener('load', () => {
+    const mbsubsup = document.createElementNS('http://www.w3.org/1998/Math/MathML', 'msubsup')
+    const m = document.createElementNS('http://www.w3.org/1998/Math/MathML', 'm')
+    const ms = document.createElementNS('http://www.w3.org/1998/Math/MathML', 'ms')
+    mbsubsup.appendChild(m)
+    ms.innerHTML = '<figure>'
+    mbsubsup.appendChild(ms)
+    document.documentElement.appendChild(mbsubsup)
+  })
+</script>